Is CVE-2026-123717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123717 being exploited in the wild.

How severe is CVE-2026-123717?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Eclipse Foundation Otterdog through 1.7.1.

How is CVE-2026-123717 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123717?

Check whether you run Eclipse Foundation Otterdog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123717: Eclipse Otterdog OS command injection in credential providers

CVE-2026-123717 · Severity: info · Published 2026-11-10

Eclipse Otterdog is a tool used by organizations to manage GitHub repositories at scale through configuration files. An attacker with the ability to modify organization configurations could inject arbitrary system commands that execute with the privileges of the operator running Otterdog, potentially compromising the operator's credential vault and giving access to sensitive secrets stored in Bitwarden or pass. This vulnerability affects Otterdog through version 1.7.1 when the pass or Bitwarden credential providers are used.

Vendors: Eclipse Foundation.

Quick answers

Is CVE-2026-123717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123717 being exploited in the wild.
How severe is CVE-2026-123717?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Eclipse Foundation Otterdog through 1.7.1.
Is there a fix for CVE-2026-123717?: Yes: fixed in 1.8.0. Until then: Restrict access to modify organization configuration files to trusted users only. Avoid using the pass and Bitwarden credential providers until upgrading to version 1.8.0, or temporarily use the plain credential provider if access control to configuration files is sufficiently restricted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123717 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123717?: Check whether you run Eclipse Foundation Otterdog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.8.0

Restrict access to modify organization configuration files to trusted users only. Avoid using the pass and Bitwarden credential providers until upgrading to version 1.8.0, or temporarily use the plain credential provider if access control to configuration files is sufficiently restricted.

Technical details

The vulnerability is an OS command injection in the pass and Bitwarden credential provider implementations that resolve secret references (pass:<path> or bitwarden:<item>@<field>) without properly escaping shell metacharacters. An authenticated user able to modify organization configuration files can craft malicious credential identifiers that are interpreted as shell commands when otterdog apply is executed, allowing arbitrary command execution with the privileges of the Otterdog operator. The fix in version 1.8.0 invokes the pass and Bitwarden CLIs without a shell, preventing shell expansion of the credential references.

Affected products

Eclipse Foundation Otterdog through 1.7.1

Timeline

2026-11-10: disclosed
2026-11-10: patched: Fixed in version 1.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.